Implementing and Transforming the Department of Homeland Security

Why It's High Risk

The Department of Homeland Security (DHS) began operations in March 2003 with the mission to prevent terrorist attacks within the United States, reduce vulnerabilities, minimize damages from attacks, and aid in recovery efforts. The department has initiated and continued the implementation of various policies and programs to address these missions, including programs to secure the border and critical infrastructure sectors and defend against, prepare for, and respond to threats and disasters. DHS has had to undertake these critical missions while also working to transform itself into a fully functioning cabinet department a difficult undertaking for any organization and one that can take years to complete even under less daunting circumstances.

In 2003 we designated the implementation and transformation of DHS as high risk because, among other things, it represented an enormous undertaking that would require time to achieve in an effective and efficient manner and the 22 agencies, many of which faced their own management challenges, had to transform themselves into one department. Most recently, in our January 2009 high risk update, we reported that although DHS has made progress in transforming into a fully functioning department, DHS has not yet developed a comprehensive plan to address the transformation, integration, management and mission challenges we identified since 2003. DHS has developed an Integrated Strategy for High Risk Management that outlines the department's process for, among other things, assessing risks and proposing initiatives to address challenges, but the strategy lacks details for the transformation of DHS and integration of its management functions. DHS has also developed corrective action plans to address management challenges that contain several of the key elements we have identified for a corrective action plan, such as defining the root causes of problems, identifying initiatives to address the causes and setting milestones for completion, and designating high-level officials to be responsible for implementing the plans. However, the plans generally do not contain measures to gauge performance and progress, nor do they identify the resources needed to carry out the corrective actions identified. We also reported that DHS has developed a framework to monitor the implementation of its corrective action plans, but has just begun to demonstrate progress in implementing corrective actions.

^ Back to topWhat We Found

• DHS has not yet developed a comprehensive strategy for management integration as required by the 9/11 Commission Act of 2007 in part because it has focused on building operations capacity within functional management areas. DHS has implemented management integration through certain initiatives and mechanisms to communicate and consolidate management policies, processes, and systems. However, significant management challenges exist for DHS as it continues to integrate its varied management processes, policies, and systems in areas such as financial management and information technology. In addition, DHS has increased the number of performance measures for the Management Directorate, but has not yet established measures for assessing management integration across the department, although DHS officials stated that the department intends to do so. Without these measures DHS cannot assess its progress in implementing and achieving management integration.
  Highlights of GAO-10-131 (PDF)
• DHS has made progress in strengthening its management functions, but more work remains for DHS to integrate these functions.
  Highlights of GAO-09-271 (PDF)
  • DHS has faced substantial challenges in developing an effective acquisition organization to meet mission needs and providing needed support to its component agencies. DHS has not developed clear and transparent policies and procedures for all acquisitions and lacks a sufficient acquisition workforce to implement and oversee its complex and varied procurement needs.
    Highlights of GAO-05-179 (PDF), Highlights of GAO-07-900, Highlights of GAO-08-263 (PDF), Highlights of GAO-10-588SP (PDF)
  • With regard to its financial management systems strategy, DHS has taken, but not completed, actions to, among other things, define its financial management strategy and plan; develop a comprehensive concept of operations; and implement key human capital practices and plans. However, DHS has not yet taken the necessary actions to standardize and reengineer business processes across the department, including applicable internal control, and to develop detailed consolidation and migration plans. In addition, the extent of DHS's reliance on contractors to define and implement key processes needed by the financial management systems program, without the necessary oversight mechanisms to ensure that the processes are properly defined and effectively implemented, could result in system efforts plagued with serious performance and management problems.
    Highlights of GAO-10-76 (PDF)
  • DHS has taken steps to implement its human capital system, but it still needs to implement more effective processes to recruit and hire employees, establish a market-based and more performance-oriented pay system, and implement its training plan.
    Highlights of GAO-08-646T (PDF)
  • DHS has undertaken efforts to establish information technology management controls, such as developing policies and procedures to ensure the protection of sensitive information. However, DHS has not yet aligned all of its investments with a comprehensive enterprise architecture or implemented a process to effectively manage its information technology investments.
    Highlights of GAO-08-646T (PDF)
  • DHS has developed an asset management plan and a generally complete real property data inventory, but it has yet to demonstrate full implementation of its asset management plan and full use of asset inventory information in its decision making.
    Highlights of GAO-07-658 (PDF)
• Although DHS continues to make progress in adopting risk management principles in implementing its mission and core management functions, the department has not fully integrated risk-based principles in its planning, programming, and budgeting decisions.
  Highlights of GAO-08-627SP (PDF), Highlights of GAO-07-454 (PDF)
• DHS can strengthen its strategic planning and performance measurement efforts to better align departmental priorities and resources to identified goals, and assess its performance and progress in achieving those goals. Although DHS has put an increased focus on performance measurement and is making improvements in this area, a number of its programs lack outcome goals and measures which may limit their effectiveness.
  Highlights of GAO-07-454 (PDF)
• Although DHS has made progress in integrating privacy considerations and protections into departmental decision making, the department faces challenges in this area, including updating the large number of public privacy notices for DHS legacy systems. In addition, Congress and others continue to raise concerns about privacy implications of emerging departmental efforts, such as the establishment of the National Applications Office, intended to facilitate sharing of Department of Defense satellite data for law enforcement and homeland security purposes.
  Highlights of GAO-07-522 (PDF)

^ Back to topWhat Needs to Be Done

• DHS should develop a comprehensive transformation and management integration strategy to guide the department's transformation and integration efforts and, once a strategy is developed, establish performance measures to assess progress made in achieving departmentwide management integration.
  Highlights of GAO-10-76 (PDF), Highlights of GAO-07-833T (PDF), Highlights of GAO-05-139 (PDF)
• DHS should strengthen its management functions by, for example,
  • routinely assessing requirements for major, complex investments to ensure they are well-defined and develop consistently measurable standards linked to those requirements;
    Highlights of GAO-08-263 (PDF)
  • clearly defining and documenting a departmentwide financial management strategy and plan to move forward with its financial management system integration efforts and, establish contractor oversight mechanisms to monitor the financial management systems program;
    Highlights of GAO-10-76 (PDF), Highlights of GAO-07-536 (PDF)
  • defining and documenting policies and procedures for information technology investment management, including assessing its investment portfolio at regular intervals to reflect current performance expectations; (GAO-07-424)
  • ensuring that the department and component organizations develop detailed implementation plans and related processes for training initiatives; and
    Highlights of GAO-05-888 (PDF)
  • ensuring that the department and component organizations develop detailed implementation plans and related processes for training initiatives; and
    Highlights of GAO-05-888 (PDF)
• DHS needs to establish more uniform policies and approaches for integrating risk management activities within and across sectors, including establishing metrics to gauge relevant progress.
  Highlights of GAO-07-454 (PDF), Highlights of GAO-06-91 (PDF)
• DHS should designate full-time privacy officers at key DHS components, implement a departmentwide process for the biennial review of system-of-records notices, establish a schedule for the timely issuance of DHS Privacy Office reports, and ensure that the department's annual reports to Congress include complaints of privacy violations, as required by law.
  Highlights of GAO-07-522 (PDF)

^ Back to topKey Reports

Department of Homeland Security: Assessments of Selected Complex Acquisitions

GAO-10-588SP, June 30, 2010

Summary (HTML)   Highlights Page (PDF)   Full Report (PDF, 92 pages)   Accessible Text

Financial Management Systems: DHS Faces Challenges to Successfully Consolidating Its Existing Disparate Systems

GAO-10-76, December 4, 2009

Summary (HTML)   Highlights Page (PDF)   Full Report (PDF, 32 pages)   Accessible Text   Recommendations (HTML)

Department of Homeland Security: Actions Taken Toward Management Integration, but a Comprehensive Strategy Is Still Needed

GAO-10-131, November 20, 2009

Summary (HTML)   Highlights Page (PDF)   Full Report (PDF, 52 pages)   Accessible Text   Recommendations (HTML)

Department of Homeland Security: Billions Invested in Major Programs Lack Appropriate Oversight

GAO-09-29, November 18, 2008

Summary (HTML)   Highlights Page (PDF)   Full Report (PDF, 53 pages)   Accessible Text   Recommendations (HTML)

Department of Homeland Security: Progress Report on Implementation of Mission and Management Functions

GAO-07-454, August 17, 2007

Summary (HTML)   Highlights Page (PDF)   Full Report (PDF, 328 pages)   Accessible Text

More Reports